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Abstract 

In [3J, we have introduced vectorial conception of FCSR's in Fibonacci mode. This 
conception allows us to easily analyze FCSR's over binary finite fields F2™ for n > 2. In [4], 
we describe and study the corresponding Galois mode and use it to design a new stream 
cipher. In this paper, we introduce the Ring mode for vectorial FCSR, explain the analysis 
of such Feedback registers and illustrate with a simple example. 
keywords:LFSR, FCSR, stream ciphers, 2-adic, sequences, Vectorial register 



1 Introduction 



The Ring mode was first introduced for LFSR's in fl] and adapted to binary FCSR in 0- In 
this mode, any cell can be used as a feedback bit for any other cell. Registers in Ring mode 
are represented by a matrix which can be chosen arbitrarily. The classical Fibonacci and Galois 
modes are in fact special cases of the Ring mode. Recall the notion of LFR and Ring mode. 

Definition 1.1 (LFR). Let n and r be two positive integers and T a square r x r matrix with 
coefficients in the binary field F2». A Linear Feedback Register (LFR) over F2™ of length r with 



transition matrix T is a sequence generator whose state is an element s(f) — (ao{t), ■ 
(F2«) r and whose operation state change is given by s(t + 1) = s(t).T. 



l(*)) G 



The Ring mode corresponds to the case where the matrix T = (U.j)i.j is such that ij+i,, = 1 
and ti <r 7^ 0. This mode generalizes both Fibonacci and Galois modes given respectively by the 
following transition matrix : 
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Theorem 1.1 ([5 , p. 268). The output sequence of an LFR with transition matrix T can be 
generated by an LFSR with connection polynomial equal to det(/ — XT). 
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So from a theoritical point of view, LFRs are no more powerful than LFSRs but they can provide 
efficient software implementations by reducing the number of connections and operations (see 
[5]). FCSR is a class of non linear FSR with good properties as for LFSR. In this paper, after 
review of different modes of binary FCSR and vectorial FCSR, we introduce the analog of LFR 
for registers with carry over F2" in a general setting and establishe its basic properties. To be 
more precise, fix a primitive polynomial P(X) of degree n over F2 and T a square r x r matrix 
with coefficients in the binary field F 2 n = ¥2[X]/(P(X)). We associate to T in a canonical way 
a nr x nr square matrix T with coefficients in Z and define Feedback with carry registers over 
F 2 n of length r with transition matrix T as a sequence generator whose state is an element pair 
(a(i),m(t)) where a(t) = (a (t), . . . , a r ^(t)) E (F 2 ~) r and m(t) = (mi(t), . . . , m r (t)) G (Z") r 
and whose operation state change is given by 

a(t + 1) = (a(t) ®T ffi m(i) Jmod2 
m(t + 1) = U(t) ® Te m(*))div2 

where ® is defined in section 5. We prove the following structural theorem: 

t — +00 

Theorem 1.2. T/ie 2-adic expansion "^2 c(t)2 where c(t) is any binary component of d%{€) is 

t=o 

equal to a rational number - where q — det(I rn — 27"). 



2 Binary Feedback with Carry Registers in Differents Modes 

Feedback with carry shift registers or FCSRs were developped by Goresky and Klapper [6 [7 
and [5]. These registers rely over a 2-adic elegant structure which is an alternative to the linear 
architecture of LFSRs. They differ from LFSRs by adding memories and using computations 
over Z. 

Definition 2.1. A binary FCSR in Fibonacci mode of length r and connection coefficients 
qi, . . . , q r € {0, 1} is an automaton sequence generator whose state is an element (do, a . . . , a r _i, m r _i) 
where ai £ {0, 1} for all i and m r _i G Z and whose operation state change is given by the fol- 
lowing procedure: 

• Compute the integer ay = q r ao + . . . + q±a r -x + 77i r _i in Z. 

• Compute a r — a r (mod 2) and m r -\ = a r d±v2. 

• Output ao and m r _i, shift the other coefficients a±, . . . , a r _i and enter a r and m r . 

(ao,ai, . • •) is called the output sequence and q = q r 2 r + . . . + q±2 — 1 is called the connection 
integer of the FCSR. 

Definition 2.2. A binary FCSR in Galois mode of length r with connection coefficients qi, . . . , q r € 

{0, 1} is an automaton whose state at the t th steps is an element s(t) = (ao(t), • ■ • , a r -\(t), mi(t), . . . , m r (t)) £ 

{0, 1}' x Z r and whose state change operation is as follows: 

• Compute Gi{t + 1) = qido(t) + aj+i(t) + mj+i(i) for all < i < r — 2 and ay_i(i + 1) = 
q r ao(t) + m r (t). 

• Compute a,i(t + 1) = <Tj(t + 1) (mod 2) and mj+i(f + 1) = <7j(i + l)div2 for all 1 < i < r. 

• Output ao(t) and replace di(t) by di(t + 1) and mi+i(t) by mj+i(i + 1) for all 1 < i < r. 
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s(0) is the initial state, (ao(0), ao(l), ao(2), . . .) the output sequence. 

Unlike the Fibonacci mode, all cells are simultaneously updated in Galois mode. Galois mode 
is more convenient for cryptographic applications. Whatever the mode, we associate a 2-adic 

2=+00 

integer a i^ 1 to the output sequence. 

Theorem 2.1. The 2-adic integer associated to the output sequence is a rational ^ where q is 
the connection integer (Definition 2), 

i—r—l k—r~l j—i 

— p = + m r ^i2 r — X) qi a i-j2 l i- n Fibonacci mode and 

i=0 i=l j = l 

i=r — 1 i—r 

—p = Y a i(0)2 i + X mj(0)2 J in Galois mode. 

i=0 i=l 

FCSR sequences have good randomness properties like periodicity, distribution of block, 
balanced property, maximal period sequences called /-sequences, cross-correlation of two level, 
etc. 

The Ring mode for FCSR developped in [2] generalizes both Fibonacci and Galois modes and 
has many advantages over these both modes. 

Definition 2.3 (FCR). A binary Feedback with Carry Register (FCR) of length r with transition 
matrix T is a sequence generator whose state is a pair (a(t) , m(t)) where a(t) = (aa(t), . . . , a r _ i(t)) G 
{0, 1}'' and m(t) = (mi(t), . . . ,m r (t)) E Z r ; and whose operation state change is given by 

a(t + 1)) = (a(t).T + m(t)jmod2 and m(t + 1) = (a(t).T + m(t)jd±v2. (2.1) 

Fibonacci and Galois modes of FCSR can be represented as a Ring FCSR with a special 
transition matrix of the form ( 1.1 1. The analysis of binary FCR can be made as in the Fibonacci 
case. 

Theorem 2.2. The output sequence (<Xi(0), <Xi(l), . . .) of a binary FCR defines a 2-adic integer 
which is a rational number where q = det(J — 2T). 

To generate /-sequences in Ring mode, we have to choose a matrix T such that dct(I — 2T) 
is prime and 2 is a primitive root modulo det(/ — 2T). Unfortunately there is no simple method 
for general T to do this. 



3 Vectorial FCSR in Fibonacci mode 

To construct FCSR over any finite fields F2™ , we use a vectorial conception introduced by Klapper 
|5j. We have completely developed the vectorial analysis of these registers |3j. They present the 
same basic properties as in the binary case. 

Description of the Automaton: Let P be a primitive polynomial over F2 of degree n. 
¥2 [X]/(P) is a vector space of dimension n over F2, we consider its canonical basis {l, X, . . . , X n ~ ] 
P is identified to its canonical lift in Z[X] and consider the free Z-module Z[X]/(P) of rank n 
and its canonical basis B = {l,X, ... 
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Definition 3.1. A Vectorial FCSR in Fibonacci mode over (F2, P,B) of length r with con- 
nection coefficients gi,...,g r £ ¥2[X]/(P) is an automaton whose state is an element s — 
(do, . . . , a r _i,m r _i) where aj G F2[X]/(P) and m r -\ € Z[X]/(P) and whose state change oper- 
ation is described as follows: 

• Express the elements a^q^nii in the basis V\.,X, ... , X™ -1 }. 

VieN, =a + a J 1 X + ... + a^_ 1 X™- 1 w/iere a* € {0, 1} , 

Vl<i<r, q % = q^ + q\X_+ ...+ql l _ 1 X n ~ 1 where q* E {0,1} , 
Vi > r — 1, m; = m + m^V + . . . + m^_iX™ where G Z. 

• Tafce i/ie canonical lift of aj and g^ in Z[X]/(P) wii/i respect B. 

• Compute a r = q r ao + . . . + gia r _i + m r _i as a vector in B. 

• Compute the coordinates of a r and m r with respect B: 

a$ = a] (mod 2) and = f7j(div2) = X -{a] - a]). (3.1) 

The feedback function is f(s) = (di, . . . , a r , m r _i) and the output function is g(xo, . . . , £E r _i, y) = 
x . T/ie VFCSR generate a vectorial sequence 
a = (g( s ),g(f( s )),g(f 2 ( s )),---) = (a ,a 1 ,a 2 ,...). 

Figure [l] illustrates a VFCSR over (F 2 , X 2 - X - 1, B) called VFCSR-Q in Fibonacci mode. 

Analysis: We decompose the output sequence a into n components = (a°,aj,---) and 
associate to each component its 2-adic expansion /3j = a" + aj2 + • • • and form a 2-adic vector 
/3 = (J3j)j. The connection integer q = q r 2 r + . . . + qi2 — 1 is an element in Z[X]/(P) and its 
components with respect B are (go — 1, qi, ■ ■ ■ , q r ) where g 3 = gJ2' r + . . . + gj2. We call (go, . . . , q r ) 
the connection vector of the VFCSR. Using simple computations, we show that /? is a solution 
of a linear system with integral coefficients represented by an invertible n x n matrix called the 
connection matrix of the VFCSR and denoted M.. Note that there is a subtile relation between 
the transition matrix T used in the conception of a binary Ring mode and the connection matrix 
M. used in the analysis of a Vectorial FCSR (see Example 1 after Theorem 7). 

Theorem 3.1. Consider a VFCSR in Fibonacci mode over (F2, P, B) of length r with connection 
vector (go, . . . , q n — 1), connection integer q and connection matrix M. Then for any sequence a 
generated by this VFCSR, the associated 2-adic vector (3 is in 1 detMl ^" an< ^ |det.M| is odd. M 
is the matrix in the canonical basis B of the linear transformation defined as the multiplication 
by — q and dct(AI) = M(— g) = (— l)"N(g) where N = Nq^^' is the norm of the number field 
Q[X]/(P) overQ. 

The components sequences are all periodic and the periods divide the order of 2 modulo 
|N(g)|. The period of a is the 1cm of the periods of the components sequences. We denote |N(g)| 
by g and call it the connection norm of the VFCSR. q can be represented as an ?i-form with 
arguments (go, ■ ■ ■ , g r - 1). This rt-form is determined by the form of the connection matrix. To 
generate sequences with maximal period, we must generate numbers q such that g is a prime, 2 
is a primitive root modulo g and g is represented by the rt-form defined by M.. For example, in 
the case where n = 2, g must be represented by the quadratic form u 2 + uv — v 2 with u — q — 1 
and v = gi. 
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Figure 1: VFCSR-Q in Fibonacci mode. 

Pseudorandom Properties of VFCSRs: VFCSRs sequences have good pseudorandom prop- 
erties. In fact, we have tested VFCSR in the quadratic case (n = 2) for several triplets (q, u, v) 
given in Table [l] using the package NIST STS |3J. This package consists of 15 different statisti- 
cal tests like perfect balance, good uniform distribution, the Matrix rank, the Maurer test, the 
compressibility of sequences, etc. . . For the quadratic case, we have two components sequences a 
and a x which have passed succesful all statistical tests. To read Table [T] l x is the 2-adic length 
of x and is the size of the corresponding binary FCSR; and lt x ,y) = niax(i x , l v ) is the size of the 
corresponding VFCSR-Q. 

4 Vectorial FCSR in Galois mode 

In 0], we developed the conception of VFCSR in Galois mode, especially the quadratic case 
called VFCSR-Q (see Fig [2]) and we have presented a new stream cipher design based on a 
filtered quadratic VFCSR automaton and called F- VFCSR-Q. In the following, we briefly describe 
VFCSR in Galois mode, analyses basic properties. For more details, we refer to [4 . 

Definition 4.1. A Vectorial FCSR in Galois mode over (F 2 ,P, B) of length r with connec- 
tion coefficients q\,...,q r € ¥2[X]/(P) is an automaton whose state is an element s(t) = 
(ao(i), . . . , a, — i (t), mi(i), . . . , m r (i)) where a»(i) G F2[X]/(P) and mi(t) G Z[_X]/(P) and whose 
state change operation is described as follows: 



4 VECTORIAL FCSR IN GALOIS MODE 



6 



k 


q 


hu,v) 


u 


V 


k 


q 


l(u,v) 


u 


V 


4 


n 


2 


3 


2 


16 


101419 


8 


331 


354 


4 


n 


5 


31 


50 


16 


109891 


8 


331 


330 


10 


1259 


5 


35 


34 


16 


115259 


8 


339 


338 


9 


829 


5 


35 


44 


16 


103451 


8 


339 


370 


13 


8821 


6 


85 


28 


16 


112181 


8 


351 


380 


11 


2389 


6 


85 


124 


16 


121421 


8 


351 


332 


12 


8179 


6 


89 


86 


17 


132499 


8 


373 


390 


11 


3581 


6 


89 


124 


17 


157141 


8 


373 


316 


13 


9949 


6 


95 


84 


18 


389219 


9 


637 


662 


12 


7621 


6 


95 


108 


18 


395429 


9 


651 


692 


18 


411491 


9 


639 


634 












18 


424451 


9 


651 


650 












18 


428339 


9 


657 


662 












18 


443771 


9 


657 


638 












18 


467171 


9 


683 


682 












18 


481619 


9 


675 


634 












18 


502499 


9 


689 


646 












20 


1164589 


9 


1001 


204 












20 


3932741 


10 


2001 


2036 













Table 1: Some triplets and their length. 



• Write elements in the basis B. 

V0 < i < r, di(t) = al(t) + a\(t)X + ..._+ a^^X 71 - 1 where aj(i) G {0, 1} , 

Vl<i<r, q l = q\ ) + q\X + ...+q\ 1 _ l X n - 1 where q) e {0, 1} , 

Vl<i<r, m l (t) = ml l {t) + m\{t)X + ... + ml l _ 1 (t)X n - 1 where m){t) e Z. 

(4.1) 

• Take the canonical lift of the collection of ai(t) and qi in Z[X]/(P) with respect B. 

• Compute o~i(t + 1) = qi + iao(t) + ai + \{t) + rrii + i(t) as a vector in B. 

• Compute the coordinates of ai(t + 1) and m,i + i{t + 1) wrt B: 

a\{t + 1) = aj(t + 1) (mod 2) and . . 

mi(t + l) = l(ai(t + l)-ai(t + l)). ( ' j 

s(0) is the initial state, the feedback function is f(s(t)) = s(t + 1) and the output function is 
g(s) = g(x ,..-,x r - 1 ,y 1 ,...,y r ) = (go(s), ■ ■ ■ , g r -i(s)) = {xq, ■ ■ ■ , z r _i). The Galois VFCSR 
generates r vectorial infinite output sequences, for all < i < r — 1: 

a 1 = (gM0)), gi o f(s(0)), 9i o / 2 (s(0)), . . .) = (a i (0),a i (l),a i (2), . . .). 

Analysis: We use the same method as in the Fibonacci case except that we study r output 
vectorial sequences. Each vectorial output sequence a* corresponds to n binary sequences a* = 
(a*(0), aj(l) • • • ). Let /3* = a* (0) + a}(l)2 + • • • be the 2-adic expansion of a* and (3 a 2-adic 
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Figure 2: VFCSR-Q in Galois mode. 



vector associated to a vectorial sequence a both of length nr. Simple computations shows that 
j3 satisfies a linear system with integral coefficients. This system is represented by an invertible 
rn x rn matrix called the connection matrix of the Galois VFCSR also denoted M.. A4 is equal 
to the identity matrix minus a matrix with even coefficients. 





/ 1 — * • • • * 


-2 


(0) \ 
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* ... 1 — * 


(0) 






* ... * 
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(0) 

1 






\ * • ■ ■ * 


(0) 


■■■ ) 




Consider a VFCSR in Galois mode 


over 


(W 2 ,P,B) o 


f length 



(4.3) 



Theorem 4.1 

integer q and connection matrix Ai 
associated 2-adic vector /3 is in 



Then for any sequence a generated by this VFCSR, the 
rditMT Z " T '> I det is odd and dct(M) = M(-g). 

VFCSR in Galois mode have the same properties of VFCSRs in Fibonacci mode : periodicity, 
existence of i-sequences etc. . . Figure [2] illustrates VFCSR-Q in Galois mode. We have taken the 
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<?= 


3974140296190695420616004753553979604200521434082 
082527268932790276172312852637472641991806538949 


U— 


1993524591318275015328041611344215036460140087963 


V— 


1993524591318275015328041611344215036460140087860 



Table 2: Example of triplet connection in Galois mode 



quadratic case n = 2 (VFCSR-Q) and the triplet connection in Table |2]to design a cryptographic 
random generator. For more detail see [I]. 



5 Vectorial FCSR in Ring mode 

Definition 5.1 (VFCR). A Vectorial Feedback with Carry Register over (¥2,P,B) of length r 
withrxr transition matrix T — (tij) and coefficients mFa[X]/(P) is an automaton whose state is 
a pair (a(t), m(t)) where a(t) = (ao(i), . . . , a r —i(t)) G (¥2[X]/(P)) r and m(t) — (mi(t), . . . , m r (t)) £ 
{1a[X\/ [P)) r ; and whose operation state change is given by: 

• Write the collection of Oj(t), rrii(t) and tij in the basis B. 

• Take the canonical lift of the collection of ai(t) and oftij in Z[X]/(P) with respect B. 

• Write a(t) and m(t) as vectors of dimension nr 



a(t) 
m(t) 



(a°(t),...,a£-i(*), 



'"0 



L (t), 



(ml(t),...,m x _i{t),...,m r (t), 



(5.1) 



• Replace the multiplication aj(t)ijj in (2.1) by the "vectorial" multiplication ® in (5.2) and 
where M ti j is the matrix in the canonical basis B of the linear transformation defined by 
the multiplication by tij. 



ai(t)t itj = (4(t),...,4-i(*))®M i4J 



(5.2) 



From the blocks M ti , consider the big rn x rn matrix T — {M ti ) j j with coefficients in 
Z. 



• Write the addition with m(t) in {2.1) as a vectorial addition with the components of m(t) 
in (5.1) and compute a(t) <8> T © m(t) . 

• Apply mod 2 and div2 componentwise in this equation. 
The Ring mode for VFCSR is the case where = 1 for all i. 

Theorem 5.1. Consider a VFCR. For all < i < r — 1 and < j < n — 1, the output sequence 
(a*(0), a*(l), . . .) is associated to a rational number ^j- where q — dct(X rn — 2T). 



Example 1: FCSR and VFCSR in Fibonacci and Galois mode. VFCSR in these both 
modes can be represented respectively by the following F and G 



F 



( o 

In 







M. 



M qr \ 



q r - 1 



M qi j 



and G 



( M qi 

In 



M 9r _, M qr \ 




(5.3) 
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where I n is the identity matrix of dimension n, is the zero matrix and M qi is the matrix of 
the linear transformation in B defined as the multiplication by q^. Using linear transformations 
on lines, we show that I nr — 2F can be reduced to a 2 x 2 lower triangular block-matrix with 
the connection matrix M. in the Fibonacci case and the identity I n r r -i) on the diagonal. The 
connection matrix of Galois VFCSR in (4.3 1 is I rn — 2G* where G* is the transpose of G. For 
binary FCSR in Ring mode, M qi = qi. 



Example 2: VFCR-Q of size 2. a VFCR-Q is a VFCSR over (¥ 2 ,X 2 - X - 1,B). For 

r = 2, the register can be represented by two registers: the main register and the carry register. 
Each register can be decomposed into two modules of two cells or two carries (see Fig [3]) . The 




Figure 3: Vectorial Feedback with Carry for q = 61. 



transition matrix T is of the form (|5.4|) and the computations are given by (|5.5|) 



T = 



V 





t 1 ' 1 

H 






l l 








t 2 ' 1 




,2,2 

r o 


,2,2 


t 2 ' 1 


'o ' h 


,2,2 
r l 





(og(t), oS(i), ao(*). «!(*)) ® 7" © (™o (t),m\ (t), m 2 (t), m 2 (t)). 



(5.4) 



(5.5) 



We can built 2 nr distinct VFCRs over of size r. Among all binary FCR of size 4, the 
maximal period is 60 and there is a VFCR-Q of size 2 generating a sequence with this period (see 
Table [3]). For example, with the transition matrix T bellow which correponds to the transition 
matrix T (5.6 1, we can generate two vectorial sequences with period ord,j(2) = 60 where q = 
I det(7 — 27q)| = 61. We have loading initial state (oq, e^, r^, m 2 ) = (1 + X, 1, 0, X) and output 
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the sequence of Table [4] 



T 



X X 
1 + X 



T 



(° 


1 





1 
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1 


1 


1 










V i 


2 











(5.6) 



Registers 


differents 
models 


values 

q= |det(J-2T)| 


maximal period 
ord 9 -(2) = q - 1 


binary FCR of size 2 


2 4 


1,3,5 


2,4 


binary FCR of size 4 


2 16 


1,3,5,7,9, •••,59,61,63, 
69,75,77,81,87,91,99,135 


2,4,10,12,18, 
28,36,52,58,60 


VFCSR-Q in Fib. 
and Gal. of size 2 


2 4 


1,5,9,11,19,25,29 
,31,41 


4,10,18,28 


VFCR-Q 
of size 2 


2« 


1,5,9,11,19,25,29, 
31,41,45,49,55,61,99 


4,10,18,28,60 



Table 3: Comparaison of maximal periods of FCR of size 2, 4 and VFCR-Q of size 2. 



4 


1000111010010011000010000011010111000101101100 


«? 


1110111110010100011101001001100001000001101011 




1111011111001010001110100100110000100000110101 


a\ 


0100101101100111101111100101000111010010011000 


a" 


1111011111001010001110100100110000100000110101 


a? 


1000101101100111101111100101000111010010011000 


a£ 


1100010110110011110111110010100011101001001100 


a} 


0100000110101110001011011001111011111001010001 



Table 4: Example of VFCR-Q sequence of period 60. 



6 Vectorial memory requirements 

It's important to describe the memory behavior when the register runs. Concretely, each cell has 
a determined number of connections (with other cells of the main register) over the connection 
to the memory cell corresponding (see figure El. It exists a range of values stable for the memory. 



Theorem 6.1. Consider a VFCR with vectorial transition matrix T . Call C* the (in + j)- 
th column of T and w l j the sum of its coefficients. Let (a(t),m(t)) the state of the t-th step 
of the register. The coordinates of the next state are given by the following recursive relation: 
a{t).C) + m){t) = a){t + 1) + 2m){t + 1). Ifm^t) e [0, w)[, then m){t + 1) e [0, w)[. 



For example, with the transition matrix T (5.6 1 and the initial state (1 + X,1,0,X), we 
obtain these following values for the memories: For example, with the vectorial transition matrix 
T (5.6 1 and the initial state (1 + X, 1, 0, X), we obtain the memory values of the Tableland we 
can see that mj] returns and remains in the interval [0,Wq[, toJ in [0, Wi[, mj in [0, Wq[ and m\ 
in [0, w\[ where Wq = 3, = 5, wj = 1 and w\ — 2. 
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connection 




connections 



Figure 4: Representation of cell and its connections. 



m 


012211122221111111122222111011100011100001111--- 




012212233332212332123333112122212232211112232-- 


ml 


ooooooooooooooooooooooooooooooooooooooooooooo--- 


m\ 


111101111100100000000000000011100010000011011--- 



Table 5: Memory values. 



7 Conclusion 



We extended the notion of VFCSR to the notion of VFCR which are defined by an arbitrary 
transition matrix. This allows to vary the model register playing with the connections and to 
construct FCR over F 2 « . On the other hand, VFCR structure allowed to extract n bytes every 
time the generator is clocked, it is more efficient than the classical FCR. Moreover, we can obtain 
maximal periods greather than those of the classical models called Fibonacci, Galois or Ring. 
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